Inflearn brand logo image
Inflearn brand logo image
BEST

๋ฌด์ž‘์ • ๋”ฐ๋ผํ•˜๋ฉฐ ์›๋ฆฌ๋ฅผ ๊นจ์šฐ์น˜๋Š” ์›น ํ•ดํ‚น : WebGoat ํŽธ

WebGoat ๋ฌธ์ œ ํ’€์ด๋ฅผ ํ†ตํ•ด ๋ฌด์ž‘์ • ๋”ฐ๋ผํ•˜๋ฉด์„œ ๋ฐฐ์šฐ๊ณ , ์ตํžˆ๊ณ , ์›๋ฆฌ๋ฅผ ํŒŒ์•…ํ•  ์ˆ˜ ์žˆ๋Š” ์›น ํ•ดํ‚น ๊ฐ•์˜!

์ด๋Ÿฐ ๊ฑธ ๋ฐฐ์šธ ์ˆ˜ ์žˆ์–ด์š”

  • WebGoat๋ž€ ๋ฌด์—‡์ธ๊ฐ€?

  • ๊ฐ์ข… ์›น ๊ธฐ๋Šฅ ๋ณ„ ์ทจ์•ฝ์  ์‘์šฉ ํ•™์Šต

  • OWASP Top 10 ํ•ญ๋ชฉ ์ง„๋‹จ ๋ฐฉ๋ฒ•

์›น๊ณ ํŠธ ๊ฐ€์ƒํ™˜๊ฒฝ์œผ๋กœ ์ทจ์•ฝ์  ์‹ค์Šตํ•˜๊ณ , ์›น ํ•ดํ‚น ํ•œ ๋‹จ๊ณ„ ๋ ˆ๋ฒจ ์—…! 

๐Ÿ’ก ์›น ํ•ดํ‚น ์‹ค์Šต์„ ์œ„ํ•œ, ์œ ๋ช… ๊ฐ€์ƒ ํ™˜๊ฒฝ WebGoat !

WebGoat๋Š” JAVA ๊ธฐ๋ฐ˜์œผ๋กœ ์ œ์ž‘๋œ ์›น ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜์œผ๋กœ, ์›น ํ•ดํ‚น ์ทจ์•ฝ์  ํ•ญ๋ชฉ๋ณ„๋กœ ์ทจ์•ฝ ํ™˜๊ฒฝ์ด ๊ตฌ์„ฑ๋˜์–ด ์žˆ์œผ๋ฉฐ ๋‹ค์–‘ํ•œ ๊ธฐ๋Šฅ๋ณ„ ์ทจ์•ฝ์  ์‹ค์Šต์ด ๊ฐ€๋Šฅํ•ฉ๋‹ˆ๋‹ค.

 

๐Ÿ’ก ์›น ํ•ดํ‚น ์ž…๋ฌธ ๊ฐ•์˜ ์ดํ›„ ์‘์šฉ ํ•™์Šต์„ ์œ„ํ•œ ๊ฐ•์˜!

์›น ๊ฐœ๋ฐœ์ž์™€ ์ •๋ณด๋ณด์•ˆ ์ž…๋ฌธ์ž๋ฅผ ์œ„ํ•œ ์›น ํ•ดํ‚น ์ž…๋ฌธ ๊ฐ•์˜ ์ดํ›„ ๊ฐ์ข… ํ™˜๊ฒฝ์— ๋”ฐ๋ฅธ ์‘์šฉ ํ•™์Šต์„ ์œ„ํ•œ ๊ฐ•์˜์ž…๋‹ˆ๋‹ค! 

 

๐Ÿ“– ๋ฌด์ž‘์ • ๋”ฐ๋ผํ•˜๋ฉด์„œ ๋ฐฐ์šฐ๊ณ  ์ตํžˆ๊ณ  ์›๋ฆฌ๋ฅผ ํŒŒ์•…ํ•˜๋Š” ๊ฐ•์˜!

WebGoat ๋ฌธ์ œ ํ’€์ด ์‹ค์Šต์„ ํ†ตํ•ด ์›น ํ•ดํ‚น์„ ์‰ฝ๊ฒŒ ๋ฐฐ์šฐ๊ณ  ๊ณต๊ฒฉ ๋ฐฉ๋ฒ•์„ ์ตํž ์ˆ˜ ์žˆ์œผ๋ฉฐ, ์ทจ์•ฝ์  ์›๋ฆฌ ํŒŒ์•…์„ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

 

๐Ÿ“ WebGoat์—์„œ ๋‹ค๋ฃจ๋Š” ์›น ํ•ดํ‚น ์ทจ์•ฝ์  ํ•ญ๋ชฉ

OWASP Top 10 ํ•ญ๋ชฉ ์œ„์ฃผ๋กœ ์ทจ์•ฝ์  ํ•ญ๋ชฉ์ด ๊ตฌ์„ฑ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค.

  1. Injection
    - SQL Injection
    - Path traversal
  2. Broken Authentication
    - Authentication Bypasses
    - JWT tokens
    - Password reset
    - Secure Passwords
  3. Sensitive Data Exposure
    - Insecure Login
  4. XML External Entities(XXE)
  5. Broken Access Control
    - Insecure Direct Object References
    - Missing Function Level Access Control
  6. Cross-Site Scripting(XSS)
  7. Insecure Deserialization
  8. Vulnerable Components
  9. Request Forgeries
    - Cross-Site Request Forgery(CSRF)
    - Server-Side Request Forgery(SSRF)
  10. Client side
    - Bypass front-end restrictions
    - Client side filtering
    - HTML tempering

์ˆ˜๊ฐ• ์ „ ํ™•์ธํ•ด์ฃผ์„ธ์š”!

  • ๋ณธ ๊ฐ•์˜๋Š” WebGoat 8.1.0 ๋ฒ„์ „์„ ์‚ฌ์šฉํ•ด ์ œ์ž‘๋œ ๊ฐ•์˜์ž…๋‹ˆ๋‹ค.

๐Ÿ’ก ํ•„์ˆ˜ ์‹œ์ฒญ ๊ฐ•์ขŒ

๋ฐ˜๋“œ์‹œ ์•Œ๊ณ  ๋„˜์–ด๊ฐ€์•ผ ํ•  ์›น ๊ธฐ์ˆ  ๊ธฐ์ดˆํŽธ
์›น ๊ธฐ์ˆ  ๊ธฐ์ดˆ๋ฅผ ์ตํž ์ˆ˜ ์žˆ๋Š” ๊ฐ•์ขŒ
์„ฑ๊ณต์ ์ธ SQL ์ธ์ ์…˜ ๊ณต๊ฒฉ์„ ์œ„ํ•œ, SQL ๊ธฐ๋ณธ ๋ฌธ๋ฒ•
SQL ์ธ์ ์…˜ ๊ณต๊ฒฉ์„ ์ตํžˆ๊ธฐ ์œ„ํ•œ ๊ธฐ์ดˆ ๋‹จ๊ณ„
์›น ๊ฐœ๋ฐœ์ž๋“ค์ด ๋ฐ˜๋“œ์‹œ ์•Œ์•„์•ผ ๋ ,
์›น ํ•ดํ‚น๊ณผ ๋ณด์•ˆ ๊ทธ๋ฆฌ๊ณ  ์‹œํ์–ด ์ฝ”๋”ฉ

์›น ๊ฐœ๋ฐœ์ž์™€ ์ •๋ณด๋ณด์•ˆ ์ž…๋ฌธ์ž๋“ค์„ ์œ„ํ•œ ์›น ํ•ดํ‚น ๊ฐ•์˜!
 

์ด๋Ÿฐ ๋ถ„๋“ค๊ป˜
์ถ”์ฒœ๋“œ๋ ค์š”!

ํ•™์Šต ๋Œ€์ƒ์€
๋ˆ„๊ตฌ์ผ๊นŒ์š”?

  • ์ •๋ณด๋ณด์•ˆ ์ž…๋ฌธ์ž

  • ์›น ๊ฐœ๋ฐœ์ž

  • IT ์ „๊ณต์ž

  • ์›น ํ•ดํ‚น์ด ๊ถ๊ธˆํ•œ๋ถ„

์„ ์ˆ˜ ์ง€์‹,
ํ•„์š”ํ• ๊นŒ์š”?

  • ์›น ๊ธฐ์ดˆ

  • ์›น ํ”„๋ก์‹œ

  • ์›น ํ•ดํ‚น ๊ธฐ์ดˆ

์•ˆ๋…•ํ•˜์„ธ์š”
์ž…๋‹ˆ๋‹ค.

25,354

๋ช…

์ˆ˜๊ฐ•์ƒ

1,300

๊ฐœ

์ˆ˜๊ฐ•ํ‰

492

๊ฐœ

๋‹ต๋ณ€

4.9

์ 

๊ฐ•์˜ ํ‰์ 

18

๊ฐœ

๊ฐ•์˜

:: ๊ตญ๋‚ด ์ •๋ณด๋ณด์•ˆ ์†”๋ฃจ์…˜ ๊ฐœ๋ฐœ ๊ธฐ์—… ์žฌ์ง ::
- ์•ฑ ์œ„๋ณ€์กฐ ๋ฐฉ์ง€ ์†”๋ฃจ์…˜ : ๋ฏธ๋“ค์›จ์–ด ๋‹ด๋‹น / ํ•ดํ‚น ๋Œ€ํšŒ ์šด์˜์ง„ / ๊ตญ๋‚ด ์œ ๋ช… ํ•ดํ‚น/๋ฐฉ์–ด ํ›ˆ๋ จ์žฅ ์ œ์ž‘

:: ๊ตญ๋‚ด ์ •๋ณด๋ณด์•ˆ ์ „๋ฌธ ์—…์ฒด ์žฌ์ง ::
- ๋ธ”๋ž™๋ฐ•์Šค ๋ชจ์˜ํ•ดํ‚น / ์‹œ๋‚˜๋ฆฌ์˜ค ๊ธฐ๋ฐ˜ ๋ชจ์˜ํ•ดํ‚น / ์›น ์ทจ์•ฝ์  ์ง„๋‹จ / ๋ชจ๋ฐ”์ผ ์ทจ์•ฝ์  ์ง„๋‹จ / ์†Œ์Šค์ฝ”๋“œ ์ทจ์•ฝ์  ์ง„๋‹จ / APT ๋ชจ์˜ ํ›ˆ๋ จ / DDoS ๋ชจ์˜ํ›ˆ๋ จ / ์ธํ”„๋ผ ์ง„๋‹จ / ์Šค๋งˆํŠธ ๊ฐ€์ „ ์ง„๋‹จ
- ๊ตญ๋‚ด ๋Œ€๊ธฐ์—…, ์ค‘์†Œ๊ธฐ์—… ๋‹ค์ˆ˜ ์ง„๋‹จ

:: ์™ธ๋ถ€ ๊ต์œก ๋ฐ ํ™œ๋™ ::
- ๋ฉ€ํ‹ฐ์บ ํผ์Šค, ๊ตญ๊ฐ€ ๋ณด์•ˆ ๊ธฐ์ˆ  ์—ฐ๊ตฌ์†Œ(ETRI)
- ๊ตญ๋‚ด ์ •๋ณด๋ณด์•ˆ ์—…์ฒด : ์žฌ์ง์ž ๋Œ€์ƒ "์›น ๋ชจ์˜ํ•ดํ‚น ์‹ฌํ™” ๊ต์œก" ์ง„ํ–‰์ค‘
- ํ•ด์ปคํŒฉํ† ๋ฆฌ ๋ฌธ์ œ ์ œ์ž‘

:: ์ทจ์•ฝ์  ๋ฐœ๊ฒฌ ::

1) Web Application Server ์ทจ์•ฝ์ 
- TMAX JEUS : ์›๊ฒฉ ๋ช…๋ น์–ด ์‹คํ–‰ ์ทจ์•ฝ์ (Remote Command Execution Vulnerability)
- IBM WebSphere(CVE-2020-4163) : ์›๊ฒฉ ๋ช…๋ น์–ด ์‹คํ–‰ ์ทจ์•ฝ์ (Remote Command Execution Vulnerability)

2) CMS(Contents Management System) ์ทจ์•ฝ์ 
- ๋„ค์ด๋ฒ„ ์Šค๋งˆํŠธ์—๋””ํ„ฐ : ํŒŒ์ผ ์—…๋กœ๋“œ ์ทจ์•ฝ์ 
- ๊ทธ๋ˆ„๋ณด๋“œ : SQL Injection , ํŒŒ์ผ ์—…๋กœ๋“œ ์ทจ์•ฝ์ (๊ทธ๋ˆ„๋ณด๋“œ4, ๊ทธ๋ˆ„๋ณด๋“œ5), XSS ...
- ํ‚ด์Šคํ : ํŒŒ๋ฆฌ๋ฏธํ„ฐ ๋ณ€์กฐ ์ทจ์•ฝ์  , ํŒŒ์ผ ์—…๋กœ๋“œ ์ทจ์•ฝ์ 

* ์ด๋ฉ”์ผ : crehacktive3@naver.com
* ๋ธ”๋กœ๊ทธ : http://www.crehacktive.co.kr

์ปค๋ฆฌํ˜๋Ÿผ

์ „์ฒด

91๊ฐœ โˆ™ (11์‹œ๊ฐ„ 50๋ถ„)

๊ฐ•์˜ ๊ฒŒ์‹œ์ผ: 
๋งˆ์ง€๋ง‰ ์—…๋ฐ์ดํŠธ์ผ: 

์ˆ˜๊ฐ•ํ‰

์ „์ฒด

21๊ฐœ

5.0

21๊ฐœ์˜ ์ˆ˜๊ฐ•ํ‰

  • anwi505152585๋‹˜์˜ ํ”„๋กœํ•„ ์ด๋ฏธ์ง€
    anwi505152585

    ์ˆ˜๊ฐ•ํ‰ 5

    โˆ™

    ํ‰๊ท  ํ‰์  5.0

    5

    67% ์ˆ˜๊ฐ• ํ›„ ์ž‘์„ฑ

    The lecture was great! I'm thinking of purchasing the file upload lecture, but when will Part 2 come out?

    • crehacktive
      ์ง€์‹๊ณต์œ ์ž

      I will do my best to complete it by the second half of this year.

  • ruke240888๋‹˜์˜ ํ”„๋กœํ•„ ์ด๋ฏธ์ง€
    ruke240888

    ์ˆ˜๊ฐ•ํ‰ 16

    โˆ™

    ํ‰๊ท  ํ‰์  4.3

    5

    77% ์ˆ˜๊ฐ• ํ›„ ์ž‘์„ฑ

    It was good that there was more explanation of the solution process than just a simple solution process~ Creative that I trust and listen to!

    • jeshurun๋‹˜์˜ ํ”„๋กœํ•„ ์ด๋ฏธ์ง€
      jeshurun

      ์ˆ˜๊ฐ•ํ‰ 11

      โˆ™

      ํ‰๊ท  ํ‰์  5.0

      5

      85% ์ˆ˜๊ฐ• ํ›„ ์ž‘์„ฑ

      It was good for learning the basics of penetration testing.

      • youjunglee5462๋‹˜์˜ ํ”„๋กœํ•„ ์ด๋ฏธ์ง€
        youjunglee5462

        ์ˆ˜๊ฐ•ํ‰ 3

        โˆ™

        ํ‰๊ท  ํ‰์  4.7

        5

        31% ์ˆ˜๊ฐ• ํ›„ ์ž‘์„ฑ

        • wh70457329๋‹˜์˜ ํ”„๋กœํ•„ ์ด๋ฏธ์ง€
          wh70457329

          ์ˆ˜๊ฐ•ํ‰ 5

          โˆ™

          ํ‰๊ท  ํ‰์  4.2

          5

          100% ์ˆ˜๊ฐ• ํ›„ ์ž‘์„ฑ

          If you don't mind spending money, the explanations are currently focused on practice, so they are very helpful.

          ํฌ๋ฆฌํ•ตํ‹ฐ๋ธŒ๋‹˜์˜ ๋‹ค๋ฅธ ๊ฐ•์˜

          ์ง€์‹๊ณต์œ ์ž๋‹˜์˜ ๋‹ค๋ฅธ ๊ฐ•์˜๋ฅผ ๋งŒ๋‚˜๋ณด์„ธ์š”!

          ๋น„์Šทํ•œ ๊ฐ•์˜

          ๊ฐ™์€ ๋ถ„์•ผ์˜ ๋‹ค๋ฅธ ๊ฐ•์˜๋ฅผ ๋งŒ๋‚˜๋ณด์„ธ์š”!